Re: Silly and stupid post-condition or not ?

[Robert A Duff <bobduff@shell01.TheWorld.com>]

"Randy Brukardt" <randy@rrsoftware.com> writes:

> I've done this in my programs by simply commenting them out; ...

Well, that's one way to "turn off" assertions.

I agree it would be good to have more control over
super-expensive assertions.  GNAT has some features like that.

>>>...(as always, it's like taking off the seatbelts
>>> when you leave the garage...).
>>
>> I don't buy this analogy (nor the similar one about life jackets and
>> sailboats).  Seatbelts often save lives and reduce injuries
>> when something goes wrong.  Preconditions (etc) don't cause
>> programs to give correct answers when something goes wrong
>> -- they just detect the wrongness.
>
> Turning off constraint checks make a program erroneous, and thus the program 
> can return wrong answers without any notice.

Yes, of course.  But that's got nothing to do with seatbelts!

> Today, this sort of thing is a security problem...

Yes, for programs that accept untrusted inputs.
A compiler, for example, doesn't have that problem
(unless you hook it up to the internet!).

>... - constraint checks at least 
> bound the problem to at worse a denial-of-service problem, much less of a 
> problem than allowing a buffer overflow that allows anything to be executed.

Yes, DoS are less of a problem than stealing the credit-card database.
So I suppose I must admit this has a bit of "seatbelt" flavor to it
(analogous to "reduce injuries").

> I admit that is less of a problem for preconditions and the like, but I 
> think the same holds true -- particular if the correctness checks were 
> removed from the code in favor of the preconditions.
>
>> By the way, I find that when I (at first) think I want a
>> pre/post, it's usually better expressed as a subtype predicate.
>> My favorite new feature of Ada 2012.
>
> I agree. I originally thought that predicates were a better solution to the 
> problem than pre/post/invariants. I still do for most uses, but of course 
> whenever multiple parameters are involved you have to use a precondition 
> instead.

Right.

- Bob